CVE-2024-6756 Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload

What is CVE-2024-6756?

CVE-2024-6756 is a high-severity vulnerability in WPWeb Social Auto Poster, published on 24 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.

Weakness: CWE-434

Which versions are affected by CVE-2024-6756?

It affects 1 product.

Products include Wpwebinfotech Social Auto Poster.

How do I fix CVE-2024-6756?

No fix has been published for CVE-2024-6756 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-6756 being exploited?

There is no known exploitation of CVE-2024-6756 in the wild and no public exploit code.

Other vulnerabilities in WPWeb Social Auto Poster

• CVE-2024-6750 Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions High 7.3
• CVE-2024-6753 Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-47369 WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-6755 Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion Medium 6.5
• CVE-2024-6752 Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7vg8-pfw4-vmjp.